Re: [Razor-users] Razor-check not using sha1 value inrazor-whitelist file
Hmm, looking through the code, it seems ehash whitelisting is not supported. Frankly, this feature is not really popular and has not been supported for a while. We are going to either remove it or bring it up-to-date in the next release. In the meantime, could you send us razor-check -H output for the mails you are trying to whitelist and we'll be able to tell you what's going on and how to fix it. cheers, vipul -Original Message- From: Jim Hermann - UUN Hostmaster [mailto:[EMAIL PROTECTED] Sent: Tue 1/2/2007 5:50 AM To: Vipul Ved Prakash; razor-users@lists.sourceforge.net Subject: RE: [Razor-users] Razor-check not using sha1 value inrazor-whitelist file What is the ehash? The documentation indicates that I can add this line to the whitelist: sha1 _SsH-KtgO9VSZa2dpZ4fHt9OeOcA Jim From: Vipul Ved Prakash [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 02, 2007 03:01 AM To: Jim Hermann - UUN Hostmaster; razor-users@lists.sourceforge.net Subject: RE: [Razor-users] Razor-check not using sha1 value inrazor-whitelist file SHA1 sig is not used in the newer versions of Razor. Did you try listing the ehash? cheers, vipul -Original Message- From: [EMAIL PROTECTED] on behalf of Jim Hermann - UUN Hostmaster Sent: Mon 1/1/2007 9:14 AM To: razor-users@lists.sourceforge.net Subject: Re: [Razor-users] Razor-check not using sha1 value inrazor-whitelist file Still waiting to hear something about this problem. Jim -Original Message- From: Jim Hermann - UUN Hostmaster [mailto:[EMAIL PROTECTED] Sent: Saturday, October 28, 2006 10:37 AM To: 'razor-users@lists.sourceforge.net' Subject: RE: Razor-check not using sha1 value in razor-whitelist file What is the status of this Bug? I submitted it back in July. Jim -Original Message- From: Jim Hermann - UUN Hostmaster [mailto:[EMAIL PROTECTED] Sent: Sunday, July 09, 2006 11:14 AM To: 'razor-users@lists.sourceforge.net' Subject: Razor-check not using sha1 value in razor-whitelist file I can't seem to get Razor2 2.82 to ignore the signature for an almost-empty part of a two-part email message. I added the signature to my razor-whitelist file (see below) and ran razor-check -d on the problem message (see below). The first part of the message only contains the Content-Type: and Content-Transfer-Encoding: MIME Headers (see end). It is a very common signature. What am I doing wrong? [EMAIL PROTECTED] root]# more .razor/razor-whitelist # very common sig for a while - 0 sha1 D97Kd_xW_1oOAN-3F7RJ1YFbxdgA # Sermon from Oct 9 - 0 sha1 3gJA9N19dYApDVMC26HUpvz_hR8A # play - 1 sha1 CmwHRX1s-wtWuNJcC0FH_SNjhCkA # GMUUC Christmas Programs - 0 is all whitespace # Eco task force devon 2 - 0 is all whitespace # Undelivered Mail Returned to Sender - 0 sha1 JudMQLN-L4uGbsGerXGnSrZf0Z8A # Hungarian attachment sha1 TOo0BfnapRgA sha1 TOo0BfnasnsA sha1 TOo0Bfnac78A sha1 TOo0BfnaFDwA sha1 TOo0BfnaA68A sha1 TOo0BfnafMMA sha1 TOo0BfnadpoA sha1 TOo0Bfna7UsA sha1 TOo0BfnawmUA sha1 TOo0BfnaVJUA # Hungarian email sha1 Zo0h2U0QssnhBNQj-mObW0jMPR4A sha1 8a_aC4syhaX8mO0-Whh200t_zEsA sha1 vd-pOTFH-yXWwIaHtM6SIzlt7X8A # blank messages sha1 zdGTYRw61hrsYQoLvVL2vWL1u_EA sha1 _SsH-KtgO9VSZa2dpZ4fHt9OeOcA sha1 Hv5WLPo9LTz96VJOTNKYM3618zQA sha1 GKXO6MQg0SCjpwnR6yP7PX_G--4A [EMAIL PROTECTED] root]# razor-check -d /home/virtual/admin4/var/mail/ham Razor-Log: Computed razorhome from env: /root/.razor Razor-Log: Found razorhome: /root/.razor Razor-Log: read_file: 15 items read from /root/.razor/razor-agent.conf Jul 09 10:49:11.875911 check[24335]: [ 2] [bootup] Logging initiated LogDebugLevel=9 to stdout Jul 09 10:49:11.876400 check[24335]: [ 5] computed razorhome=/root/.razor, conf=/root/.razor/razor-agent.conf, ident=/root/.razor/identity Jul 09 10:49:11.876501 check[24335]: [ 2] Razor-Agents v2.82 starting razor-check -d /home/virtual/admin4/var/mail/ham Jul 09 10:49:11.878176 check[24335]: [ 9] uname -a: Linux host.uuserver.net 2.6.10
Re: [Razor-users] Razor-check not using sha1 value inrazor-whitelist file
SHA1 sig is not used in the newer versions of Razor. Did you try listing the ehash? cheers, vipul -Original Message- From: [EMAIL PROTECTED] on behalf of Jim Hermann - UUN Hostmaster Sent: Mon 1/1/2007 9:14 AM To: razor-users@lists.sourceforge.net Subject: Re: [Razor-users] Razor-check not using sha1 value inrazor-whitelist file Still waiting to hear something about this problem. Jim -Original Message- From: Jim Hermann - UUN Hostmaster [mailto:[EMAIL PROTECTED] Sent: Saturday, October 28, 2006 10:37 AM To: 'razor-users@lists.sourceforge.net' Subject: RE: Razor-check not using sha1 value in razor-whitelist file What is the status of this Bug? I submitted it back in July. Jim -Original Message- From: Jim Hermann - UUN Hostmaster [mailto:[EMAIL PROTECTED] Sent: Sunday, July 09, 2006 11:14 AM To: 'razor-users@lists.sourceforge.net' Subject: Razor-check not using sha1 value in razor-whitelist file I can't seem to get Razor2 2.82 to ignore the signature for an almost-empty part of a two-part email message. I added the signature to my razor-whitelist file (see below) and ran razor-check -d on the problem message (see below). The first part of the message only contains the Content-Type: and Content-Transfer-Encoding: MIME Headers (see end). It is a very common signature. What am I doing wrong? [EMAIL PROTECTED] root]# more .razor/razor-whitelist # very common sig for a while - 0 sha1 D97Kd_xW_1oOAN-3F7RJ1YFbxdgA # Sermon from Oct 9 - 0 sha1 3gJA9N19dYApDVMC26HUpvz_hR8A # play - 1 sha1 CmwHRX1s-wtWuNJcC0FH_SNjhCkA # GMUUC Christmas Programs - 0 is all whitespace # Eco task force devon 2 - 0 is all whitespace # Undelivered Mail Returned to Sender - 0 sha1 JudMQLN-L4uGbsGerXGnSrZf0Z8A # Hungarian attachment sha1 TOo0BfnapRgA sha1 TOo0BfnasnsA sha1 TOo0Bfnac78A sha1 TOo0BfnaFDwA sha1 TOo0BfnaA68A sha1 TOo0BfnafMMA sha1 TOo0BfnadpoA sha1 TOo0Bfna7UsA sha1 TOo0BfnawmUA sha1 TOo0BfnaVJUA # Hungarian email sha1 Zo0h2U0QssnhBNQj-mObW0jMPR4A sha1 8a_aC4syhaX8mO0-Whh200t_zEsA sha1 vd-pOTFH-yXWwIaHtM6SIzlt7X8A # blank messages sha1 zdGTYRw61hrsYQoLvVL2vWL1u_EA sha1 _SsH-KtgO9VSZa2dpZ4fHt9OeOcA sha1 Hv5WLPo9LTz96VJOTNKYM3618zQA sha1 GKXO6MQg0SCjpwnR6yP7PX_G--4A [EMAIL PROTECTED] root]# razor-check -d /home/virtual/admin4/var/mail/ham Razor-Log: Computed razorhome from env: /root/.razor Razor-Log: Found razorhome: /root/.razor Razor-Log: read_file: 15 items read from /root/.razor/razor-agent.conf Jul 09 10:49:11.875911 check[24335]: [ 2] [bootup] Logging initiated LogDebugLevel=9 to stdout Jul 09 10:49:11.876400 check[24335]: [ 5] computed razorhome=/root/.razor, conf=/root/.razor/razor-agent.conf, ident=/root/.razor/identity Jul 09 10:49:11.876501 check[24335]: [ 2] Razor-Agents v2.82 starting razor-check -d /home/virtual/admin4/var/mail/ham Jul 09 10:49:11.878176 check[24335]: [ 9] uname -a: Linux host.uuserver.net 2.6.10-1.771_FC2 #1 Mon Mar 28 00:50:14 EST 2005 i686 i686 i386 GNU/Linux Jul 09 10:49:11.878607 check[24335]: [ 8] reading mbox formatted mail from /home/virtual/admin4/var/mail/ham Jul 09 10:49:11.880389 check[24335]: [ 6] read 1 mail Jul 09 10:49:11.880645 check[24335]: [ 8] Client supported_engines: 4 8 Jul 09 10:49:11.882518 check[24335]: [ 8] prep_mail done: mail 1 headers=671, mime0=115, mime1=43476 Jul 09 10:49:11.883384 check[24335]: [ 5] read_file: 21 items read from /root/.razor/razor-whitelist Jul 09 10:49:11.883672 check[24335]: [ 8] loaded 1 different types of whitelist Jul 09 10:49:11.883893 check[24335]: [ 5] read_file: 1 items read from /root/.razor/servers.discovery.lst Jul 09 10:49:11.884115 check[24335]: [ 5] read_file: 2 items read from /root/.razor/servers.nomination.lst Jul 09 10:49:11.884441 check[24335]: [ 5] read_file: 3 items read from /root/.razor/servers.catalogue.lst Jul 09 10:49:11.884794 check[24335]: [ 9] Assigning defaults to joy.cloudmark.com Jul 09 10:49:11.884936 check[24335]: [ 9] Assigning defaults to folly.cloudmark.com Jul 09 10:49:11.885107 check[24335]: [ 9] Assigning defaults to c101.cloudmark.com Jul 09 10:49:11.885246 check[24335]: [ 9] Assigning defaults to shock.cloudmark.com Jul 09 10:49:11.885370 check[24335]: [ 9] Assigning defaults to c102.cloudmark.com Jul 09 10:49:11.886004 check[24335]: [ 5] read_file: 19 items read from /root/.razor/server.c101.cloudmark.com.conf Jul 09 10:49:11.886475 check[24335]: [ 5] read_file: 19 items read from /root/.razor/server.c101.cloudmark.com.conf Jul 09 10:49:11.886863 check[24335]: [ 5] read_file: 18 items read from /root/.razor/server.joy.cloudmark.com.conf Jul 09 10:49:11.887243 check[24335]: [ 5] read_file: 18 items read from /root/.razor
Re: [Razor-users] Razor-check not using sha1 value inrazor-whitelist file
From time to time, Razor-check will report a hit for an apparently blank message with an attachment. The offending ehash is for the apparently blank part of the message. The MIME message contains two or more parts and the HTML part contains only a few tags and no text. Razor-check calculates the ehash for this part and compares it with the database. Often, it will match reported spam because some reported spam is sent as an attachment to a matching apparently blank message. Here is my ehash list for apparently blank messages: D97Kd_xW_1oOAN-3F7RJ1YFbxdgA JudMQLN-L4uGbsGerXGnSrZf0Z8A zdGTYRw61hrsYQoLvVL2vWL1u_EA _SsH-KtgO9VSZa2dpZ4fHt9OeOcA Hv5WLPo9LTz96VJOTNKYM3618zQA GKXO6MQg0SCjpwnR6yP7PX_G--4A Each ehash comes and goes in the database, depending upon the reported spam. Jim From: Vipul Ved Prakash [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 02, 2007 06:00 PM To: Jim Hermann - UUN Hostmaster; razor-users@lists.sourceforge.net Subject: RE: [Razor-users] Razor-check not using sha1 value inrazor-whitelist file Hmm, looking through the code, it seems ehash whitelisting is not supported. Frankly, this feature is not really popular and has not been supported for a while. We are going to either remove it or bring it up-to-date in the next release. In the meantime, could you send us razor-check -H output for the mails you are trying to whitelist and we'll be able to tell you what's going on and how to fix it. cheers, vipul -Original Message- From: Jim Hermann - UUN Hostmaster [mailto:[EMAIL PROTECTED] Sent: Tue 1/2/2007 5:50 AM To: Vipul Ved Prakash; razor-users@lists.sourceforge.net Subject: RE: [Razor-users] Razor-check not using sha1 value inrazor-whitelist file What is the ehash? The documentation indicates that I can add this line to the whitelist: sha1 _SsH-KtgO9VSZa2dpZ4fHt9OeOcA Jim From: Vipul Ved Prakash [mailto:[EMAIL PROTECTED] Sent: Tuesday, January 02, 2007 03:01 AM To: Jim Hermann - UUN Hostmaster; razor-users@lists.sourceforge.net Subject: RE: [Razor-users] Razor-check not using sha1 value inrazor-whitelist file SHA1 sig is not used in the newer versions of Razor. Did you try listing the ehash? cheers, vipul -Original Message- From: [EMAIL PROTECTED] on behalf of Jim Hermann - UUN Hostmaster Sent: Mon 1/1/2007 9:14 AM To: razor-users@lists.sourceforge.net Subject: Re: [Razor-users] Razor-check not using sha1 value inrazor-whitelist file Still waiting to hear something about this problem. Jim -Original Message- From: Jim Hermann - UUN Hostmaster [mailto:[EMAIL PROTECTED] Sent: Saturday, October 28, 2006 10:37 AM To: 'razor-users@lists.sourceforge.net' Subject: RE: Razor-check not using sha1 value in razor-whitelist file What is the status of this Bug? I submitted it back in July. Jim -Original Message- From: Jim Hermann - UUN Hostmaster [mailto:[EMAIL PROTECTED] Sent: Sunday, July 09, 2006 11:14 AM To: 'razor-users@lists.sourceforge.net' Subject: Razor-check not using sha1 value in razor-whitelist file I can't seem to get Razor2 2.82 to ignore the signature for an almost-empty part of a two-part email message. I added the signature to my razor-whitelist file (see below) and ran razor-check -d on the problem message (see below). The first part of the message only contains the Content-Type: and Content-Transfer-Encoding: MIME Headers (see end). It is a very common signature. What am I doing wrong? [EMAIL PROTECTED] root]# more .razor/razor-whitelist # very common sig for a while - 0 sha1 D97Kd_xW_1oOAN-3F7RJ1YFbxdgA # Sermon from Oct 9 - 0 sha1 3gJA9N19dYApDVMC26HUpvz_hR8A # play - 1 sha1 CmwHRX1s-wtWuNJcC0FH_SNjhCkA # GMUUC Christmas Programs - 0
